Use event input information

Use event input information

The Event Input pane that is
included in the steps to create an event rule provides a reference to the information that you
can use when configuring an event rule.

In the Transform and compose alert output pane, you can also drag the
information into the required fields to customize alert content. The fields in the right-hand
pane appear as a reference to which fields, expressions, and their values are available when
working in the Event Rule designer. The fields that display in the Transform and
compose alert output left-hand workarea become the fields in the generated alert
form.

General components and navigation

The Event Input pane consists of these sections:

Event Additional Info

Expressions

Event Raw Info

The Event Input pane displays in all Event Rule designer sections,
except for the Event Rule Info section. The fields in the right-pane
can be modified only in the Transform and compose alert output section.
In all the other sections, the Event Input pane is read-only and
available for reference purposes.

Note: If Accessibility enabled is selected in System Settings, standard edit mode is not available .

Edit modes

Mode

Description

Standard edit mode

Text selected in the left-hand workarea cannot be edited. Undo is not
available. In this mode, you can only mark the text or values and transform it by
selecting a field name.

Regex edit mode

Edit text in the left-hand workarea by selecting it, as required. After you
have edited the text, you cannot go back to the standard mode.
Undo is not available. However,
Reset is available, returning the field to its original
value. You can compose text using regular expression (regex) format conventions, for
example, type (.*) to create a field name. You cannot use field values like: type
"$" to include the value of a field and specify the name of the field in parentheses
{}.

You can include special characters in a field by "escaping" them, that is, by
prefixing the character with a "\". For example, to include a "\" in your text,
enter "\\".

Event additional info

The Event additional info section displays
default event form fields, plus fields that were created to display in alerts and that are
added to the Additional information section of the alert.

When
configuring text in the fields in the left-hand workarea, you can drag field names and/or
their value from this section into the fields.

Expressions

The expressions section is available only if an additional information field was created.
You can create expressions from event raw data or from additional information data.

Click in a field in the Event Input pane to perform
transformation actions.

Create an expression by transforming information and associating it with a field name.
Either select a field name from the suggested list, or create a field name, as
required.

Click in a field in the Event Input pane. In the left-hand
workarea, select the required information.

Create expressions by transforming information and associating it with a field name. Select
a field name from the suggested list, or you can create a field name, as required.

Event raw info

The Event raw info section is always available. Its
contents are the fields from the Event form.

To transform text, click a field in the
right-panel to open it in the work area on the left-panel, in the Mark Expressions section.
You can select text in the Mark Expressions section where the selected
text becomes the value of a newly created field. Name the new field. This new field is added
to the Expressions section.

Note: When creating regex expression for input, ensure that you create input with the
variables in sequential order. While variables can be skipped for inclusion, the selected
order must be maintained.

Controlling how fields appear:

Use the blacklist [em_event_rule_black_list] table to hide fields from the
right-pane.

Use the em_event_rule_order form to order the position of each field.

Fields that are not in the blacklist and also not part of the em_event_rule_order
table, still appear in the event rule designer, in the right-panel and in the
Transform and Compose Alert Output tab.

Use event input information

Use event input information

The Event Input pane that is
included in the steps to create an event rule provides a reference to the information that you
can use when configuring an event rule.

In the Transform and compose alert output pane, you can also drag the
information into the required fields to customize alert content. The fields in the right-hand
pane appear as a reference to which fields, expressions, and their values are available when
working in the Event Rule designer. The fields that display in the Transform and
compose alert output left-hand workarea become the fields in the generated alert
form.

General components and navigation

The Event Input pane consists of these sections:

Event Additional Info

Expressions

Event Raw Info

The Event Input pane displays in all Event Rule designer sections,
except for the Event Rule Info section. The fields in the right-pane
can be modified only in the Transform and compose alert output section.
In all the other sections, the Event Input pane is read-only and
available for reference purposes.

Note: If Accessibility enabled is selected in System Settings, standard edit mode is not available .

Edit modes

Mode

Description

Standard edit mode

Text selected in the left-hand workarea cannot be edited. Undo is not
available. In this mode, you can only mark the text or values and transform it by
selecting a field name.

Regex edit mode

Edit text in the left-hand workarea by selecting it, as required. After you
have edited the text, you cannot go back to the standard mode.
Undo is not available. However,
Reset is available, returning the field to its original
value. You can compose text using regular expression (regex) format conventions, for
example, type (.*) to create a field name. You cannot use field values like: type
"$" to include the value of a field and specify the name of the field in parentheses
{}.

You can include special characters in a field by "escaping" them, that is, by
prefixing the character with a "\". For example, to include a "\" in your text,
enter "\\".

Event additional info

The Event additional info section displays
default event form fields, plus fields that were created to display in alerts and that are
added to the Additional information section of the alert.

When
configuring text in the fields in the left-hand workarea, you can drag field names and/or
their value from this section into the fields.

Expressions

The expressions section is available only if an additional information field was created.
You can create expressions from event raw data or from additional information data.

Click in a field in the Event Input pane to perform
transformation actions.

Create an expression by transforming information and associating it with a field name.
Either select a field name from the suggested list, or create a field name, as
required.

Click in a field in the Event Input pane. In the left-hand
workarea, select the required information.

Create expressions by transforming information and associating it with a field name. Select
a field name from the suggested list, or you can create a field name, as required.

Event raw info

The Event raw info section is always available. Its
contents are the fields from the Event form.

To transform text, click a field in the
right-panel to open it in the work area on the left-panel, in the Mark Expressions section.
You can select text in the Mark Expressions section where the selected
text becomes the value of a newly created field. Name the new field. This new field is added
to the Expressions section.

Note: When creating regex expression for input, ensure that you create input with the
variables in sequential order. While variables can be skipped for inclusion, the selected
order must be maintained.

Controlling how fields appear:

Use the blacklist [em_event_rule_black_list] table to hide fields from the
right-pane.

Use the em_event_rule_order form to order the position of each field.

Fields that are not in the blacklist and also not part of the em_event_rule_order
table, still appear in the event rule designer, in the right-panel and in the
Transform and Compose Alert Output tab.

Confirm

SubscribeSubscribedUnsubscribeLast updated:Tags:JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNovemberDecemberNo Results FoundVersionsSearch preferences successfully updatedMy release version successfully updatedMy release version successfully deletedAn error has occurred. Please try again later.You have been unsubscribed from all topics.You are now subscribed toand will receive notifications if any changes are made to this page.You have been unsubscribed from this contentThank you for your feedback.Form temporarily unavailable. Please try again or contact
docfeedback@servicenow.com
to submit your comments.The topic you requested does not exist in therelease. You were redirected to a related topic instead.The available release versions for this topic are listedThere is no specific version for this documentation.Explore productsClick to go to thepage.Release notes and upgradesClick to open thedropdown menu.DeleteRemoveNo selected versionReset